diff --git a/.dockerignore b/.dockerignore
index 4683652..39061cb 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -12,6 +12,7 @@ data
 .DS_Store
 npm-debug.log*
 Dockerfile
+Dockerfile.check
 .dockerignore
 docker-compose.yml
 extracted
diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 3771585..6e31690 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -17,11 +17,9 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Lint and test
-        # In the runner's own Docker, so this needs no extra actions. A failure
-        # here stops the image being built, rather than deploying a broken one.
-        run: |
-          docker run --rm -v "$PWD":/src -w /src node:22-bookworm-slim \
-            sh -c "npm ci --no-audit --no-fund && npm run lint && npm test"
+        # Built, not mounted: this job runs in a container, so a host bind mount
+        # of $PWD arrives empty. A failure here stops the image being built.
+        run: docker build -f Dockerfile.check -t printhive-check .
 
       - name: Log in to the Forgejo container registry
         # REGISTRY_TOKEN = a Forgejo access token with write:package scope, added
diff --git a/Dockerfile.check b/Dockerfile.check
new file mode 100644
index 0000000..39495f9
--- /dev/null
+++ b/Dockerfile.check
@@ -0,0 +1,11 @@
+# Lint and tests, run in CI. A build context rather than a bind mount, because
+# the CI job runs inside a container of its own — $PWD there means nothing to
+# the Docker daemon, so a mounted folder arrives empty.
+FROM node:22-bookworm-slim
+WORKDIR /src
+
+COPY package.json package-lock.json ./
+RUN npm ci --no-audit --no-fund
+
+COPY . .
+RUN npm run lint && npm test